SOC Engineer

Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation.

We are looking for a SOC Engineer to join our Security Operations team and help defend a fast-moving, cloud-native AI vibe-coding platform. In this role, your primary mandate will be building and evolving our security data lake, engineering reliable security telemetry, and owning high-fidelity detection engineering end-to-end. You will unify cloud, identity, endpoint, and application telemetry, staying on top of emerging threats to rapidly build and tune detections across our environment. Alongside this data and detection mandate, you will support incident investigations as needed to translate real-world threats into stronger automated defenses. This is a hands-on engineering role requiring strong technical depth, understanding of modern software engineering and CI/CD systems, familiarity with cloud-native infrastructure (especially GCP), and expertise in security data pipelines and detection workflows.

• →

  Security Data Lake & Detection Engineering: Architect, expand, and maintain our security data lake while designing, testing, and tuning custom detection rules to maximize threat coverage and minimize noise across our cloud-native stack.

• →

  Threat Awareness & Rapid Assessment: Continuously monitor emerging threats (0-days, bad actor activity, public exploitation campaigns, bug bounty reports, customer security issues) and rapidly assess their applicability to Replit's infrastructure, SaaS services, internal tools, and platform components.

• →

  Investigation & Impact Analysis: Conduct targeted investigations to determine impact, analyze logs, telemetry, and system behaviors using SIEM, metrics, and Cloud Logging and identify gaps in detection/visibility.

• Building and evolving the security data lake, unifying cloud, identity, endpoint, and application telemetry; hands-on experience with SIEM, Cloud Logging, and log-based investigation workflows.

• Engineering reliable security infrastructure and automation using infrastructure-as-code to close visibility gaps and perform log-based investigations.

• Proven expertise in detection engineering end-to-end, specifically developing, testing, and tuning custom detection rules to maximize threat coverage and reduce noise across complex environments.

• Strong understanding of software engineering fundamentals (code structure, build systems, dependencies, package ecosystems).

• Understanding of CI/CD pipelines and DevOps workflows.

• Solid knowledge of cloud architecture, especially Google Cloud Platform (GCP) services in modern cloud-native deployments.

• Familiarity with SaaS architectures, identity systems, and integration patterns.

• Experience with threat intelligence, security research, or vulnerability analysis.

• Familiarity with Kubernetes, containers, serverless infrastructure, or modern distributed systems.

• Ability to write scripts or small tools for investigation or automation (Python, Go, Bash).

• Experience working with bug bounty programs or coordinated vulnerability disclosure workflows.

• Experience in fast-paced, cloud-native, or AI/ML-driven environments.

• Self-driving Company

• Replit Agent at Scale

• AI Adoption

• Build Open-Source Apps

   

• Operating Principles

• Reasons not to work at Replit

To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.